Page 345 - GDPR and US States General Privacy Laws Deskbook

345 | Tennessee Information Protection Act
(d)  Determining whether a person is acting as a controller or processor with respect to a specific processing of data is a fact-
based determination that depends upon the context in which personal information is to be processed. A processor that
continues to adhere to a controller’s instructions with respect to a specific processing of personal information remains a
processor.
47-18-3206. Data protection assessments.
(a)  A controller shall conduct and document a data protection assessment of each of the following processing activities
involving personal information:
(1) The processing of personal information for purposes of targeted advertising;
(2) The sale of personal information;
(3)  The processing of personal information for purposes of profiling, where the profiling presents a reasonably foreseeable
risk of:
(A) Unfair or deceptive treatment of, or unlawful disparate impact on, consumers;
(B) Financial, physical, or reputational injury to consumers;
(C)  A physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where
the intrusion would be offensive to a reasonable person; or
(D) Other substantial injury to consumers;
(4) The processing of sensitive data; and
(5) Processing activities involving personal information that present a heightened risk of harm to consumers.
(b)  Data protection assessments conducted pursuant to subsection (a) must identify and weigh the benefits that may flow,
directly and indirectly, from the processing to the controller, the consumer, other stakeholders, and the public against
the potential risks to the rights of the consumer associated with the processing, as mitigated by safeguards that can
be employed by the controller to reduce the risks. The use of de-identified data and the reasonable expectations of
consumers, as well as the context of the processing and the relationship between the controller and the consumer whose
personal information will be processed, must be factored into this assessment by the controller.
(c)  The attorney general and reporter may request pursuant to a civil investigative demand that a controller disclose a data
protection assessment that is relevant to an investigation conducted by the attorney general and reporter, and the
controller shall make the data protection assessment available to the attorney general and reporter. The attorney general
and reporter may evaluate the data protection assessment for compliance with the responsibilities set forth in § 47-18-
3204. Data protection assessments are confidential and not open to public inspection and copying. The disclosure of a
data protection assessment pursuant to a request from the attorney general and reporter does not constitute a waiver
of attorney-client privilege or work product protection with respect to the assessment and information contained in the
assessment.
(d) A single data protection assessment may address a comparable set of processing operations that include similar activities.
(e)  Data protection assessments conducted by a controller for the purpose of compliance with other laws, rules, or regulations
may comply with this section if the assessments have a reasonably comparable scope and effect.
(f)  Data protection assessment requirements apply to processing activities created or generated on or after July 1, 2024, and
are not retroactive.